.TH tcpsubnet 8  "2018-03-01" "USER COMMANDS"
.SH NAME
tcpsubnet \- Summarize and aggregate IPv4 TCP traffic by subnet.
.SH SYNOPSIS
.B tcpsubnet [\-h] [\-v] [\--ebpf] [\-J] [\-f FORMAT] [\-i INTERVAL] [subnets]
.SH DESCRIPTION
This tool summarizes and aggregates IPv4 TCP sent to the subnets
passed in argument and prints to stdout on a fixed interval.

This uses dynamic tracing of kernel TCP send/receive functions, and will
need to be updated to match kernel changes.

The traced data is summarized in-kernel using a BPF map to reduce overhead.
At very high TCP event rates, the overhead may still be measurable.
See the OVERHEAD section for more details.

Since this uses BPF, only the root user can use this tool.
.SH REQUIREMENTS
CONFIG_BPF and bcc.
.SH OPTIONS
.TP
\-h
Print USAGE message.
.TP
\-v
Run in verbose mode. Will output subnet evaluation and the BPF program
.TP
\-J
Format output in JSON.
.TP
\-i
Interval between updates, seconds (default 1).
.TP
\-f
Format output units. Supported values are bkmBKM. When using
kmKM the output will be rounded to floor.
.TP
\--ebpf
Prints the BPF program.
.TP
subnets
Comma separated list of subnets. Traffic will be categorized
in theses subnets. Order matters.
(default 127.0.0.1/32,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,0.0.0.0/0)
.SH EXAMPLES
.TP
Summarize TCP traffic by the default subnets:
#
.B tcpsubnet
.TP
Summarize all TCP traffic:
#
.B tcpsubnet 0.0.0.0/0
.TP
Summarize all TCP traffic and output in JSON and Kb:
#
.B tcpsubnet -J -fk 0.0.0.0/0
.SH FIELDS
.TP
(Standad output) Left hand side column:
Subnet
.TP
(Standard output) Right hand side column:
Aggregate traffic in units passed as argument
.TP
(JSON output) date
Current date formatted in the system locale
.TP
(JSON output) time
Current time formatted in the system locale
.TP
(JSON output) entries
Map of subnets to aggregates. Values will be in format passed to -f
.SH OVERHEAD
This traces all tcp_sendmsg function calls in the TCP/IP stack.
It summarizes data in-kernel to reduce overhead.
A simple iperf test (v2.0.5) with the default values shows a loss
of ~5% throughput. On 10 runs without tcpsubnet running the average
throughput was 32.42Gb/s, with tcpsubnet enabled it was 31.26Gb/s.
This is not meant to be used as a long running service. Use it
for troubleshooting or for a controlled interval. As always,
try it out in a test environment first.

.SH SOURCE
This is from bcc.
.IP
https://github.com/iovisor/bcc
.PP
Also look in the bcc distribution for a companion _examples.txt file containing
example usage, output, and commentary for this tool.
.SH OS
Linux
.SH STABILITY
Unstable - in development.
.SH AUTHOR
Rodrigo Manyari
.SH INSPIRATION
tcptop(8) by Brendan Gregg
.SH SEE ALSO
netlink(7)